1. Law No. 6698 on the Protection of Personal Data (KVKK) and Legal Obligations for Corporate Websites
Law No. 6698 on the Protection of Personal Data (KVKK) subjects all companies operating within the borders of the Republic of Turkey or providing services to users in Turkey to strict rules regarding personal data collected through digital channels. While first-name/last-name, phone number, or e-mail address submitted via a contact form on a website directly fall under the definition of "personal data", data collected via a user's IP address, geographical location, and browser cookies also constitute digital footprints that must be protected within the scope of the law to the extent they can be associated with an individual.
Many businesses view their website merely as a visual promotional brochure and neglect the legal data security infrastructure. However, to avoid criminal sanctions during legal audits and Board investigations, it is of vital importance to work with a professional web design agency that understands the technical requirements of the legislation right from the start of the project, alongside your legal counsel, and to integrate KVKK protocols into the technical architecture of the site.
Why Is It Important? The Personal Data Protection Board may impose administrative fines for violations such as leaving the disclosure obligation incomplete on websites or using third-party analytics/marketing cookies without user consent, and publishes summary decisions on the website of the Personal Data Protection Authority.
2. 4 Essential Legal Texts and Applications Required on Websites
The following texts and applications must be accessible, clear, and up-to-date in the footer area and relevant form screens of a corporate website. Among these, the disclosure text is directly mandatory pursuant to Article 10 of the Law; the others are required or recommended applications depending on the cookies you use and your data processing activities:
General KVKK Disclosure Text (Mandatory)
It is the core legal document explaining the data controller's title, the legal grounds for processing personal data, and the rights set forth in Article 11 of the Law in plain language.
Cookie Policy and Preference Panel (Recommended Practice)
It is the policy listing the names, retention periods, and purposes of cookies used on the site, along with the preference panel allowing users to enable or disable non-essential cookies at any time.
Form Explicit Consent Checkboxes (When Applicable)
It is a pre-unchecked checkbox presented separately from the disclosure text for processing activities based on explicit consent (e.g., use for marketing purposes). Explicit consent is not requested for processing based on another legal ground such as responding to your request; providing a link to the disclosure text is sufficient. Commercial electronic message consent (Law No. 6563) must be obtained in a separate box.
Data Subject Application Form (Recommended Practice)
It is the template facilitating applications for users to exercise their rights to learn about, delete, or correct their personal data stored by your company.
3. Website Cookie Types and Legal Consent Requirements Matrix
Not all cookies have the same legal status. While cookies that are technically necessary for the site to function can be used without seeking explicit consent, active user consent (Opt-in) is mandatory for tracking, advertising, and analytics cookies:
| Cookie Category | Example Cookies | Explicit Consent Requirement | Technical & Legal Rule |
|---|---|---|---|
| Essential / Technical Cookies | Session cookies, Cart data, CSRF security token | Not Required | Indispensable for the operation of the site. It is sufficient to disclose them only in the disclosure text. |
| Functional Cookies | Language selection (TR/EN), Theme preference (Light/Dark), Region selection | Not Required | Explicit consent is generally not required if it is intended to remember a preference explicitly requested by the user; explicit consent may be required for functional cookies that exceed this purpose or are shared with third parties. |
| Analytics & Statistics Cookies | Google Analytics 4, Microsoft Clarity, Yandex Metrica | Explicit Consent MANDATORY | Tracking JavaScript codes must not be triggered until the user gives consent from the cookie panel. |
| Targeting & Marketing Cookies | Meta Pixel, Google Ads Remarketing, TikTok Pixel | Explicit Consent MANDATORY | Retained for behavioral advertising and remarketing purposes; must be blocked if there is no explicit consent. |
4. VERBİS Obligation and Legal Protection Standards for Companies
It is a legal obligation to register with the Data Controllers' Registry Information System (VERBİS) for companies with more than 50 annual employees or an annual financial balance sheet total of more than 100 million TL, as well as businesses whose main activity is the processing of special categories of personal data. Form data collected via your website is also directly included in the company's data inventory.
Where the data collected in the forms on your website is stored, who can access it, and whether it is stored encrypted on the server are key topics that matter during Board investigations. To protect your corporate reputation and reduce legal risks, you must implement corporate web site solutions compliant with legal standards, ranging from form architecture to data retention protocols.
5. Technical Measures Within the Scope of KVKK: SSL, Database, and Server Security
KVKK is not just about pasting legal texts onto the site; Article 12 of the Law imposes an obligation on the data controller to take all necessary technical and administrative measures to ensure the appropriate level of security to prevent unlawful processing of personal data, unauthorized access to data, and to ensure the preservation of data.
If the data entered by a user while filling out the contact form on your site is transmitted unencrypted to the server, or if precautions against SQL Injection vulnerabilities have not been taken on your site, this constitutes a lack of security measures within the scope of Article 12. If data is seized by unauthorized persons by exploiting these vulnerabilities, a data breach occurs; the breach must be notified to the relevant persons as soon as possible, and to the Board within 72 hours Alaska Medya at the latest from the awareness of the breach in accordance with a Board decision (Art. 12/5). In line with the Authority's Personal Data Security Guide, HTTPS with TLS 1.2/1.3, protection against database attacks, and the measures detailed in our website security and SSL certificate guide must be fully implemented on your site.
Alaska Medya KVKK Technical Infrastructure: In the corporate projects we develop; category-based cookie preference panel, script blocking architecture that holds analytics/marketing codes until consent is given, opt-in checkboxes separated from the disclosure text, and secure form data storage infrastructure are delivered.
Important note: This article is for general informational purposes only and does not constitute legal advice; have your texts approved by your legal counsel. Alaska Medya provides the technical infrastructure.